Forensics Specialists must search at a bit level across a wide range of areas inside a computer. This includes email, temporary files, swap files, slack and free space, web-browser cache, history, bookmarks.

What if the hard-drive or a portion of the drive is encrypted?

Should investigators attempt to decode encrypted files?

Please support your statement and explain if you can present it in the court of law.

.